Jinher OA EUVD-2026-59788

Q: What is the CVSS score of EUVD-2026-59788?

EUVD-2026-59788 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19905 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-15 cna@vuldb.com

GHSA-h7mq-ph84-r982

SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint (AV:N, PR:N, UI:N) with straightforward SQL injection (AC:L); limited C/I/A impact reflects scoped attendance module database context rather than full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 19:31 vuln.today

DescriptionCVE.org

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Jinher OA 1.0 exposes the attendance approval endpoint to unauthenticated remote attackers via the unvalidated httpOID parameter in /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. Publicly available exploit code exists, lowering the bar for exploitation significantly. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been issued.

Technical ContextAI

Jinher OA is a Chinese-origin office automation platform built on ASP.NET (evidenced by the .aspx file extension). The affected endpoint is part of the HRM (Human Resource Management) attendance submodule. CWE-74 (Injection) identifies the root cause as improper neutralization of user-supplied input before it is used in a backend command - in this case, SQL. The httpOID query or form parameter is concatenated directly into a SQL statement without sanitization or parameterized query use, allowing an attacker to alter query logic. No CPE string was provided in the input data, so exact product versioning beyond '1.0' cannot be confirmed from NVD metadata alone.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. Organizations running Jinher OA 1.0 should immediately restrict access to the /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx endpoint at the network perimeter or web application firewall layer - blocking or rate-limiting external access to this path eliminates the network attack vector without affecting backend database integrity, though it may disrupt remote attendance approval workflows. Deploying a WAF rule to detect and block SQL injection patterns in the httpOID parameter provides a secondary control. If neither control is feasible, placing the application behind VPN or IP allowlisting for authorized users only is recommended. Monitor VulDB entry 390110 (https://vuldb.com/vuln/390110) and the researcher's GitHub issue (https://github.com/pangdudu24/cve/issues/1) for any future vendor response or community-developed patches.